Sylius / InvoicingPlugin

Generate an Invoice for every placed order
MIT License
80 stars 84 forks source link

InvoiceVoter does not support other instances of Sylius\Component\User\Model\UserInterface #298

Open j92 opened 2 years ago

j92 commented 2 years ago

In one of my projects, we created a new GuestUser that implements a Sylius\Component\User\Model\UserInterface. When I tried to access an invoice with that user, the Sylius\InvoicingPlugin\Security\Voter\InvoiceVoter denied access, because it only handles AdminUserInterface and ShopUserInterface. The AdminUserInterface check seems fine, but perhaps we can consider to loosen the ShopUserInterface type check to something like a type check for Sylius\Component\Customer\Model\CustomerAwareInterface as the Customer is the only data we need in that place?

if ($user instanceof Sylius\Component\Customer\Model\CustomerAwareInterface) {
    $customer = $user->getCustomer();

    Assert::isInstanceOf($customer, CustomerInterface::class);

    return null !== $this->orderRepository->findOneByNumberAndCustomer($invoice->orderNumber(), $customer);
}

What do you think?

diimpp commented 1 year ago

Looks like issue is fixed and can be closed. @j92 @GSadee